/*
 * 2021/12/16	19:16
 *
 *	linux二进制分析	P63
 */

/*
 * 在该程序中调用了puts()函数用来打印 Hello World。我们的目标是劫持puts()函数，让该程序调用 evil_puts()：
 *
 * https://www.bitlackeys.org/projects/quenya_32bit.tgz
 *
 * http://www.eresi-project.org
 * https://github.com/thorkill/eresi.git
 */

#include <stdio.h>
#include <sys/syscall.h>

#if 0

#include <bits/syscall.h>
    #ifdef __NR_write
    # define SYS_write __NR_write
    #endif

asm-generic/unistd.h:208:__SYSCALL(__NR_write, sys_write)
x86_64-linux-gnu/bits/syscall.h:2475:# define SYS_write __NR_write

sys_write : 负责将用户缓冲区的内容写入到磁盘上的文件中。

#endif

int _write(int fd, void * buf, int count)
{
	long ret = -1;

	__asm__ __volatile__ (
	"push %%ebx\n\t"
	"movl %%esi, %%ebx\n\t"
	"int $0x80\n\t" 
	"pop %%ebx" : "=a" (ret) : "0" (SYS_write), "S" ((long) fd), "c" ((long) buf), "d" ((long) count));

	if (ret >= 0) {
        printf("ret = %ld\n", ret);
		return (int)ret;
	}

	return -1;
}

int evil_puts(void)
{
	_write(1, "AACC puts() has been injection...\n", 35);
}

void main()
{
	evil_puts();
}

#if 0
gcc -o 05 05.c -m32 -no-pie

因 push 指令编译不通过，才编译的32位

08049176 <_write>:
 8049176:	f3 0f 1e fb          	endbr32 
 804917a:	55                   	push   %ebp
 804917b:	89 e5                	mov    %esp,%ebp
 804917d:	56                   	push   %esi
 804917e:	53                   	push   %ebx
 804917f:	83 ec 10             	sub    $0x10,%esp
 8049182:	e8 75 00 00 00       	call   80491fc <__x86.get_pc_thunk.ax>
 8049187:	05 79 2e 00 00       	add    $0x2e79,%eax
 804918c:	8b 4d 0c             	mov    0xc(%ebp),%ecx       // ecx=0x804a008
 804918f:	b8 04 00 00 00       	mov    $0x4,%eax            // eax=4            /* write is syscall #4 */
 8049194:	8b 5d 08             	mov    0x8(%ebp),%ebx       // ebx=1
 8049197:	8b 55 10             	mov    0x10(%ebp),%edx      // edx=35
 804919a:	89 de                	mov    %ebx,%esi            // esi=1
 804919c:	53                   	push   %ebx
 804919d:	89 f3                	mov    %esi,%ebx            // ebx=1
 804919f:	cd 80                	int    $0x80                // eax(ebx, ecx, edx)=write(1, 0x804a008, 35)
 80491a1:	5b                   	pop    %ebx
 80491a2:	89 45 f4             	mov    %eax,-0xc(%ebp)      // eax=35
 80491a5:	83 7d f4 00          	cmpl   $0x0,-0xc(%ebp)
 80491a9:	78 05                	js     80491b0 <_write+0x3a>    // eax < 0
 80491ab:	8b 45 f4             	mov    -0xc(%ebp),%eax          // eax=35
 80491ae:	eb 05                	jmp    80491b5 <_write+0x3f>    
 80491b0:	b8 ff ff ff ff       	mov    $0xffffffff,%eax     // eax=-1
 80491b5:	83 c4 10             	add    $0x10,%esp
 80491b8:	5b                   	pop    %ebx
 80491b9:	5e                   	pop    %esi
 80491ba:	5d                   	pop    %ebp
 80491bb:	c3                   	ret    

080491bc <evil_puts>:
 80491bc:	f3 0f 1e fb          	endbr32 
 80491c0:	55                   	push   %ebp
 80491c1:	89 e5                	mov    %esp,%ebp
 80491c3:	e8 34 00 00 00       	call   80491fc <__x86.get_pc_thunk.ax>
 80491c8:	05 38 2e 00 00       	add    $0x2e38,%eax
 80491cd:	6a 23                	push   $0x23
 80491cf:	8d 80 08 e0 ff ff    	lea    -0x1ff8(%eax),%eax   // "AACC puts() has been injection...\n"
 80491d5:	50                   	push   %eax
 80491d6:	6a 01                	push   $0x1
 80491d8:	e8 99 ff ff ff       	call   8049176 <_write>
 80491dd:	83 c4 0c             	add    $0xc,%esp            // 因有三个 push 导致栈变化， -4 -8 -c
 80491e0:	90                   	nop
 80491e1:	c9                   	leave  
 80491e2:	c3                   	ret    

080491e3 <main>:
 80491e3:	f3 0f 1e fb          	endbr32 
 80491e7:	55                   	push   %ebp
 80491e8:	89 e5                	mov    %esp,%ebp
 80491ea:	e8 0d 00 00 00       	call   80491fc <__x86.get_pc_thunk.ax>  // 因 -m 32 参数生成
 80491ef:	05 11 2e 00 00       	add    $0x2e11,%eax
 80491f4:	e8 c3 ff ff ff       	call   80491bc <evil_puts>
 80491f9:	90                   	nop
 80491fa:	5d                   	pop    %ebp
 80491fb:	c3                   	ret    

080491fc <__x86.get_pc_thunk.ax>:
 80491fc:	8b 04 24             	mov    (%esp),%eax      // 0xffffd394:     80491ef
 80491ff:	c3                   	ret    

#endif
